diff --git a/.editorconfig b/.editorconfig
index d416e1c9e6..cc0aa30f47 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -8,3 +8,6 @@ trim_trailing_whitespace = true
 [*.ts]
 indent_style = space
 indent_size = 2
+
+[*.(yml|yaml)]
+indent_size = 2
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 1c514912c5..f660790713 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -2,4 +2,4 @@ blank_issues_enabled: true
 contact_links:
   - name: Contact GitHub Support
     url: https://support.github.com/request
-    about: Contact Support 
+    about: Contact Support
diff --git a/.github/actions/check-codescanning-config/action.yml b/.github/actions/check-codescanning-config/action.yml
index 0c65c3a41d..bd680cc9fa 100644
--- a/.github/actions/check-codescanning-config/action.yml
+++ b/.github/actions/check-codescanning-config/action.yml
@@ -1,7 +1,7 @@
 name: Check Code-Scanning Config
 description: |
-    Checks the code scanning configuration file generated by the
-    action to ensure it contains the expected contents
+  Checks the code scanning configuration file generated by the
+  action to ensure it contains the expected contents
 inputs:
   languages:
     required: false
@@ -52,7 +52,7 @@ runs:
         tools: ${{ inputs.tools }}
         db-location: ${{ runner.temp }}/codescanning-config-cli-test
       env:
-        CODEQL_ACTION_TEST_MODE: 'true'
+        CODEQL_ACTION_TEST_MODE: "true"
 
     - name: Install dependencies
       shell: bash
@@ -62,7 +62,7 @@ runs:
       working-directory: ${{ github.action_path }}
       shell: bash
       env:
-        EXPECTED_CONFIG_FILE_CONTENTS: '${{ inputs.expected-config-file-contents }}'
+        EXPECTED_CONFIG_FILE_CONTENTS: "${{ inputs.expected-config-file-contents }}"
       run: ts-node ./index.ts "$RUNNER_TEMP/user-config.yaml" "$EXPECTED_CONFIG_FILE_CONTENTS"
     - name: Clean up
       shell: bash
diff --git a/.github/actions/query-filter-test/action.yml b/.github/actions/query-filter-test/action.yml
index f1dfc38bf2..ab4f9286af 100644
--- a/.github/actions/query-filter-test/action.yml
+++ b/.github/actions/query-filter-test/action.yml
@@ -54,7 +54,7 @@ runs:
     - name: Check SARIF
       uses: ./../action/.github/actions/check-sarif
       with:
-        sarif-file:  ${{ inputs.sarif-file }}
+        sarif-file: ${{ inputs.sarif-file }}
         queries-run: ${{ inputs.queries-run}}
         queries-not-run: ${{ inputs.queries-not-run}}
     - name: Cleanup after test
diff --git a/.github/actions/release-branches/action.yml b/.github/actions/release-branches/action.yml
index 7734411c73..3d08d43ec4 100644
--- a/.github/actions/release-branches/action.yml
+++ b/.github/actions/release-branches/action.yml
@@ -1,11 +1,11 @@
-name: 'Release branches'
-description: 'Determine branches for release & backport'
+name: "Release branches"
+description: "Determine branches for release & backport"
 inputs:
   major_version:
-    description: 'The version as extracted from the package.json file'
+    description: "The version as extracted from the package.json file"
     required: true
   latest_tag:
-    description: 'The most recent tag published to the repository'
+    description: "The most recent tag published to the repository"
     required: true
 outputs:
   backport_source_branch:
diff --git a/.github/actions/release-initialise/action.yml b/.github/actions/release-initialise/action.yml
index b734377a76..d0e99f4ed8 100644
--- a/.github/actions/release-initialise/action.yml
+++ b/.github/actions/release-initialise/action.yml
@@ -1,17 +1,16 @@
-name: 'Prepare release job'
-description: 'Prepare for updating a release branch'
+name: "Prepare release job"
+description: "Prepare for updating a release branch"
 
 runs:
   using: "composite"
   steps:
-
     - name: Dump environment
       run: env
       shell: bash
 
     - name: Dump GitHub context
       env:
-        GITHUB_CONTEXT: '${{ toJson(github) }}'
+        GITHUB_CONTEXT: "${{ toJson(github) }}"
       run: echo "$GITHUB_CONTEXT"
       shell: bash
 
@@ -19,7 +18,7 @@ runs:
       uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: 24
-        cache: 'npm'
+        cache: "npm"
 
     - name: Install JavaScript dependencies
       shell: bash
diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml
index 5f2a6fa861..22635a0d14 100644
--- a/.github/workflows/__all-platform-bundle.yml
+++ b/.github/workflows/__all-platform-bundle.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'true'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "true"
+          setup-kotlin: "true"
       - id: init
         uses: ./../action/init
         with:
diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml
index a0a14c8c5e..f916bda40a 100644
--- a/.github/workflows/__analysis-kinds.yml
+++ b/.github/workflows/__analysis-kinds.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -73,8 +73,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: javascript
@@ -82,16 +82,16 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
-          post-processed-sarif-path: '${{ runner.temp }}/post-processed'
+          post-processed-sarif-path: "${{ runner.temp }}/post-processed"
 
       - name: Upload SARIF files
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: |
             analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: '${{ runner.temp }}/results/*.sarif'
+          path: "${{ runner.temp }}/results/*.sarif"
           retention-days: 7
 
       - name: Upload post-processed SARIF
@@ -99,7 +99,7 @@ jobs:
         with:
           name: |
             post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
-          path: '${{ runner.temp }}/post-processed'
+          path: "${{ runner.temp }}/post-processed"
           retention-days: 7
           if-no-files-found: error
 
@@ -107,16 +107,16 @@ jobs:
         if: contains(matrix.analysis-kinds, 'code-scanning')
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
-          EXPECT_PRESENT: 'false'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
+          EXPECT_PRESENT: "false"
         with:
           script: ${{ env.CHECK_SCRIPT }}
       - name: Check quality query appears in quality SARIF
         if: contains(matrix.analysis-kinds, 'code-quality')
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.quality.sarif'
-          EXPECT_PRESENT: 'true'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif"
+          EXPECT_PRESENT: "true"
         with:
           script: ${{ env.CHECK_SCRIPT }}
     env:
diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml
index 1e899b39a6..e12f918e40 100644
--- a/.github/workflows/__analyze-ref-input.yml
+++ b/.github/workflows/__analyze-ref-input.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -91,7 +91,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
     env:
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml
index fcf5094e11..c9e495d0aa 100644
--- a/.github/workflows/__autobuild-action.yml
+++ b/.github/workflows/__autobuild-action.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -69,8 +69,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: csharp
@@ -78,12 +78,12 @@ jobs:
       - uses: ./../action/autobuild
         env:
           # Explicitly disable the CLR tracer.
-          COR_ENABLE_PROFILING: ''
-          COR_PROFILER: ''
-          COR_PROFILER_PATH_64: ''
-          CORECLR_ENABLE_PROFILING: ''
-          CORECLR_PROFILER: ''
-          CORECLR_PROFILER_PATH_64: ''
+          COR_ENABLE_PROFILING: ""
+          COR_PROFILER: ""
+          COR_PROFILER_PATH_64: ""
+          CORECLR_ENABLE_PROFILING: ""
+          CORECLR_PROFILER: ""
+          CORECLR_PROFILER_PATH_64: ""
       - uses: ./../action/analyze
       - name: Check database
         run: |
diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
index d0830846a0..b28b6a0843 100644
--- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
+++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
   workflow_call:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
 defaults:
   run:
     shell: bash
@@ -72,8 +72,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...
diff --git a/.github/workflows/__autobuild-working-dir.yml b/.github/workflows/__autobuild-working-dir.yml
index 489e4ed7d9..930df5d7cd 100644
--- a/.github/workflows/__autobuild-working-dir.yml
+++ b/.github/workflows/__autobuild-working-dir.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           # Make sure that Gradle build succeeds in autobuild-dir ...
diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml
index 2e89573366..e0e74bda18 100644
--- a/.github/workflows/__build-mode-autobuild.yml
+++ b/.github/workflows/__build-mode-autobuild.yml
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
   workflow_call:
     inputs:
       java-version:
         type: string
         description: The version of Java to install
         required: false
-        default: '17'
+        default: "17"
 defaults:
   run:
     shell: bash
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -92,7 +92,7 @@ jobs:
         id: init
         with:
           build-mode: autobuild
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml
index 14cdc5654e..ecca039520 100644
--- a/.github/workflows/__build-mode-manual.yml
+++ b/.github/workflows/__build-mode-manual.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -80,13 +80,13 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
           build-mode: manual
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
diff --git a/.github/workflows/__build-mode-none.yml b/.github/workflows/__build-mode-none.yml
index 690e7fe38c..c01ba25394 100644
--- a/.github/workflows/__build-mode-none.yml
+++ b/.github/workflows/__build-mode-none.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -53,13 +53,13 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
           build-mode: none
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
diff --git a/.github/workflows/__build-mode-rollback.yml b/.github/workflows/__build-mode-rollback.yml
index 0e53ba1959..e18b411562 100644
--- a/.github/workflows/__build-mode-rollback.yml
+++ b/.github/workflows/__build-mode-rollback.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Set up Java test repo configuration
         run: |
           mv * .github ../action/tests/multi-language-repo/
@@ -63,7 +63,7 @@ jobs:
         id: init
         with:
           build-mode: none
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: java
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
diff --git a/.github/workflows/__bundle-from-nightly.yml b/.github/workflows/__bundle-from-nightly.yml
index 08fb849598..57b2503e65 100644
--- a/.github/workflows/__bundle-from-nightly.yml
+++ b/.github/workflows/__bundle-from-nightly.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Bundle: From nightly'
+name: "PR Check - Bundle: From nightly"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -36,7 +36,7 @@ jobs:
         include:
           - os: ubuntu-26.04
             version: linked
-    name: 'Bundle: From nightly'
+    name: "Bundle: From nightly"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - id: init
         uses: ./../action/init
         env:
diff --git a/.github/workflows/__bundle-from-toolcache.yml b/.github/workflows/__bundle-from-toolcache.yml
index 79245e6651..23011be214 100644
--- a/.github/workflows/__bundle-from-toolcache.yml
+++ b/.github/workflows/__bundle-from-toolcache.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Bundle: From toolcache'
+name: "PR Check - Bundle: From toolcache"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -36,7 +36,7 @@ jobs:
         include:
           - os: ubuntu-26.04
             version: toolcache
-    name: 'Bundle: From toolcache'
+    name: "Bundle: From toolcache"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -60,8 +60,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Check toolcache contains CodeQL
         continue-on-error: true
         run: |
diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml
index 3f72648207..fca8336971 100644
--- a/.github/workflows/__bundle-toolcache.yml
+++ b/.github/workflows/__bundle-toolcache.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Bundle: Caching checks'
+name: "PR Check - Bundle: Caching checks"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -40,7 +40,7 @@ jobs:
             version: linked
           - os: windows-2025
             version: linked
-    name: 'Bundle: Caching checks'
+    name: "Bundle: Caching checks"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -64,8 +64,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Remove CodeQL from toolcache
         run: |
           cd ./../action
diff --git a/.github/workflows/__cleanup-db-cluster-dir.yml b/.github/workflows/__cleanup-db-cluster-dir.yml
index 904932cedf..ce9ee41da3 100644
--- a/.github/workflows/__cleanup-db-cluster-dir.yml
+++ b/.github/workflows/__cleanup-db-cluster-dir.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Add a file to the database cluster directory
         run: |
           mkdir -p "${{ runner.temp }}/customDbLocation/javascript"
@@ -62,7 +62,7 @@ jobs:
         id: init
         with:
           build-mode: none
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml
index 82ff82728c..da9e743a61 100644
--- a/.github/workflows/__config-export.yml
+++ b/.github/workflows/__config-export.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: javascript
@@ -62,18 +62,18 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
       - name: Check config properties appear in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml
index 8c4544a7a5..03934bd439 100644
--- a/.github/workflows/__config-input.yml
+++ b/.github/workflows/__config-input.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -60,8 +60,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Copy queries into workspace
         run: |
           cp -a ../action/queries .
diff --git a/.github/workflows/__cpp-deptrace-disabled.yml b/.github/workflows/__cpp-deptrace-disabled.yml
index d84e322986..5f24cd8cf8 100644
--- a/.github/workflows/__cpp-deptrace-disabled.yml
+++ b/.github/workflows/__cpp-deptrace-disabled.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - C/C++: disabling autoinstalling dependencies (Linux)'
+name: "PR Check - C/C++: disabling autoinstalling dependencies (Linux)"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -40,7 +40,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'C/C++: disabling autoinstalling dependencies (Linux)'
+    name: "C/C++: disabling autoinstalling dependencies (Linux)"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml
index cca23b0895..c0794ee878 100644
--- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml
+++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - C/C++: autoinstalling dependencies is skipped (macOS)'
+name: "PR Check - C/C++: autoinstalling dependencies is skipped (macOS)"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -38,7 +38,7 @@ jobs:
             version: linked
           - os: macos-26
             version: nightly-latest
-    name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
+    name: "C/C++: autoinstalling dependencies is skipped (macOS)"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__cpp-deptrace-enabled.yml b/.github/workflows/__cpp-deptrace-enabled.yml
index 51ce4401cb..dd74b17d6c 100644
--- a/.github/workflows/__cpp-deptrace-enabled.yml
+++ b/.github/workflows/__cpp-deptrace-enabled.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - C/C++: autoinstalling dependencies (Linux)'
+name: "PR Check - C/C++: autoinstalling dependencies (Linux)"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -40,7 +40,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'C/C++: autoinstalling dependencies (Linux)'
+    name: "C/C++: autoinstalling dependencies (Linux)"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Test setup
         run: |
           cp -a ../action/tests/cpp-autobuild autobuild-dir
@@ -75,5 +75,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml
index d6494ac789..58923dac79 100644
--- a/.github/workflows/__diagnostics-export.yml
+++ b/.github/workflows/__diagnostics-export.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -62,8 +62,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -82,18 +82,18 @@ jobs:
             --ready-for-status-page
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
 
       - name: Check diagnostics appear in SARIF
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
         run: |
           cd ../action
           npx tsx ./pr-checks/check-diagnostics.ts
diff --git a/.github/workflows/__diagnostics-without-db.yml b/.github/workflows/__diagnostics-without-db.yml
index 9a1c3d6d9f..5fbd580ccd 100644
--- a/.github/workflows/__diagnostics-without-db.yml
+++ b/.github/workflows/__diagnostics-without-db.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -67,8 +67,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Initialise failing analysis
         id: init
         uses: ./../action/init
@@ -87,11 +87,11 @@ jobs:
         # `category` input. Without this step, that part of the init post-action would fail.
         if: false
         with:
-          category: '/test-codeql-version:${{ matrix.version }}'
+          category: "/test-codeql-version:${{ matrix.version }}"
 
       - name: Check diagnostics appear on disk
         env:
-          DIAGNOSTICS_DIR: '${{ runner.temp }}/codeql-action-temp-diagnostics/'
+          DIAGNOSTICS_DIR: "${{ runner.temp }}/codeql-action-temp-diagnostics/"
         run: |
           cd ../action
           npx tsx ./pr-checks/diagnostics-without-db.ts
diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml
index 0500122576..b4e9138fe5 100644
--- a/.github/workflows/__export-file-baseline-information.yml
+++ b/.github/workflows/__export-file-baseline-information.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -100,12 +100,12 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
       - name: Check results
         run: |
diff --git a/.github/workflows/__extractor-ram-threads.yml b/.github/workflows/__extractor-ram-threads.yml
index 2275921b4f..bf9343d8d2 100644
--- a/.github/workflows/__extractor-ram-threads.yml
+++ b/.github/workflows/__extractor-ram-threads.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: java
diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml
index 0c68f0dd4e..c2f9f85141 100644
--- a/.github/workflows/__global-proxy.yml
+++ b/.github/workflows/__global-proxy.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'false'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "false"
       - name: Block direct internet access to force proxy usage
         run: |
           apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1
diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml
index db7acd1ac6..95287af329 100644
--- a/.github/workflows/__go-custom-queries.yml
+++ b/.github/workflows/__go-custom-queries.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: Custom queries'
+name: "PR Check - Go: Custom queries"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -58,7 +58,7 @@ jobs:
             version: linked
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Go: Custom queries'
+    name: "Go: Custom queries"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -93,5 +93,5 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
index b570ae4a64..bee84bef94 100644
--- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: diagnostic when Go is changed after init step'
+name: "PR Check - Go: diagnostic when Go is changed after init step"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -46,7 +46,7 @@ jobs:
         include:
           - os: ubuntu-26.04
             version: default
-    name: 'Go: diagnostic when Go is changed after init step'
+    name: "Go: diagnostic when Go is changed after init step"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -75,17 +75,17 @@ jobs:
       # Deliberately change Go after the `init` step
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.20'
+          go-version: "1.20"
       - name: Build code
         run: go build main.go
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Check diagnostic appears in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
index 137583625f..3b535ecb46 100644
--- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: diagnostic when `file` is not installed'
+name: "PR Check - Go: diagnostic when `file` is not installed"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -46,7 +46,7 @@ jobs:
         include:
           - os: ubuntu-26.04
             version: default
-    name: 'Go: diagnostic when `file` is not installed'
+    name: "Go: diagnostic when `file` is not installed"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Remove `file` program
         run: |
           echo $(which file)
@@ -81,12 +81,12 @@ jobs:
         run: go build main.go
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Check diagnostic appears in SARIF
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
-          SARIF_PATH: '${{ runner.temp }}/results/go.sarif'
+          SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml
index 5296e5837f..6a659f8eb0 100644
--- a/.github/workflows/__go-indirect-tracing-workaround.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: workaround for indirect tracing'
+name: "PR Check - Go: workaround for indirect tracing"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -46,7 +46,7 @@ jobs:
         include:
           - os: ubuntu-26.04
             version: default
-    name: 'Go: workaround for indirect tracing'
+    name: "Go: workaround for indirect tracing"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -66,8 +66,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml
index 2b7005698e..3a12fe90fd 100644
--- a/.github/workflows/__go-tracing-autobuilder.yml
+++ b/.github/workflows/__go-tracing-autobuilder.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with autobuilder step'
+name: "PR Check - Go: tracing with autobuilder step"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -66,7 +66,7 @@ jobs:
             version: nightly-latest
           - os: macos-26
             version: nightly-latest
-    name: 'Go: tracing with autobuilder step'
+    name: "Go: tracing with autobuilder step"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -106,5 +106,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml
index cc14651de7..798cb55c39 100644
--- a/.github/workflows/__go-tracing-custom-build-steps.yml
+++ b/.github/workflows/__go-tracing-custom-build-steps.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with custom build steps'
+name: "PR Check - Go: tracing with custom build steps"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -66,7 +66,7 @@ jobs:
             version: nightly-latest
           - os: macos-26
             version: nightly-latest
-    name: 'Go: tracing with custom build steps'
+    name: "Go: tracing with custom build steps"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml
index df62bf53cc..92ed9dc2fc 100644
--- a/.github/workflows/__go-tracing-legacy-workflow.yml
+++ b/.github/workflows/__go-tracing-legacy-workflow.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with legacy workflow'
+name: "PR Check - Go: tracing with legacy workflow"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,21 +17,21 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       go-version:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -66,7 +66,7 @@ jobs:
             version: nightly-latest
           - os: macos-26
             version: nightly-latest
-    name: 'Go: tracing with legacy workflow'
+    name: "Go: tracing with legacy workflow"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -86,8 +86,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go
@@ -100,5 +100,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__go.yml b/.github/workflows/__go.yml
index 3688dc6fd8..e16be4009c 100644
--- a/.github/workflows/__go.yml
+++ b/.github/workflows/__go.yml
@@ -19,10 +19,10 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 jobs:
   go-custom-queries:
-    name: 'Go: Custom queries'
+    name: "Go: Custom queries"
     permissions:
       contents: read
       security-events: read
@@ -31,7 +31,7 @@ jobs:
       dotnet-version: ${{ inputs.dotnet-version }}
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround-diagnostic:
-    name: 'Go: diagnostic when Go is changed after init step'
+    name: "Go: diagnostic when Go is changed after init step"
     permissions:
       contents: read
       security-events: read
@@ -39,7 +39,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround-no-file-program:
-    name: 'Go: diagnostic when `file` is not installed'
+    name: "Go: diagnostic when `file` is not installed"
     permissions:
       contents: read
       security-events: read
@@ -47,7 +47,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-indirect-tracing-workaround:
-    name: 'Go: workaround for indirect tracing'
+    name: "Go: workaround for indirect tracing"
     permissions:
       contents: read
       security-events: read
@@ -55,7 +55,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-autobuilder:
-    name: 'Go: tracing with autobuilder step'
+    name: "Go: tracing with autobuilder step"
     permissions:
       contents: read
       security-events: read
@@ -63,7 +63,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-custom-build-steps:
-    name: 'Go: tracing with custom build steps'
+    name: "Go: tracing with custom build steps"
     permissions:
       contents: read
       security-events: read
@@ -71,7 +71,7 @@ jobs:
     with:
       go-version: ${{ inputs.go-version }}
   go-tracing-legacy-workflow:
-    name: 'Go: tracing with legacy workflow'
+    name: "Go: tracing with legacy workflow"
     permissions:
       contents: read
       security-events: read
diff --git a/.github/workflows/__init-with-registries.yml b/.github/workflows/__init-with-registries.yml
index 2e36baddc4..3a01c3e51d 100644
--- a/.github/workflows/__init-with-registries.yml
+++ b/.github/workflows/__init-with-registries.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Download using registries'
+name: "PR Check - Packaging: Download using registries"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -40,7 +40,7 @@ jobs:
             version: linked
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Download using registries'
+    name: "Packaging: Download using registries"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -55,12 +55,12 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Init with registries
         uses: ./../action/init
         with:
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           config-file: ./.github/codeql/codeql-config-registries.yml
           languages: javascript
diff --git a/.github/workflows/__javascript-source-root.yml b/.github/workflows/__javascript-source-root.yml
index 08c68e6f94..703c6ed750 100644
--- a/.github/workflows/__javascript-source-root.yml
+++ b/.github/workflows/__javascript-source-root.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Move codeql-action
         run: |
           mkdir ../new-source-root
diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml
index 5d49830cdd..4a76f8b954 100644
--- a/.github/workflows/__job-run-uuid-sarif.yml
+++ b/.github/workflows/__job-run-uuid-sarif.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -60,12 +60,12 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
       - name: Upload SARIF
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
-          path: '${{ runner.temp }}/results/javascript.sarif'
+          path: "${{ runner.temp }}/results/javascript.sarif"
           retention-days: 7
       - name: Check results
         run: |
diff --git a/.github/workflows/__language-aliases.yml b/.github/workflows/__language-aliases.yml
index 1e5c17395a..048441fd3c 100644
--- a/.github/workflows/__language-aliases.yml
+++ b/.github/workflows/__language-aliases.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,14 +51,14 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: C#,java-kotlin,typescript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-      - name: 'Check languages'
+      - name: "Check languages"
         run: |
           expected_languages="csharp,java,javascript"
           actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)
diff --git a/.github/workflows/__linux-arm64.yml b/.github/workflows/__linux-arm64.yml
index de045d8954..02dab69f9f 100644
--- a/.github/workflows/__linux-arm64.yml
+++ b/.github/workflows/__linux-arm64.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: ${{ env.LANGUAGES }}
diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml
index bc384bdf11..e4b20c9b4a 100644
--- a/.github/workflows/__local-bundle.yml
+++ b/.github/workflows/__local-bundle.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Fetch latest CodeQL bundle
         run: |
           wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.zst
diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml
index f1028a6eb6..41588c9453 100644
--- a/.github/workflows/__multi-language-autodetect.yml
+++ b/.github/workflows/__multi-language-autodetect.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -114,8 +114,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Install Python 3.13.15 for older CLI versions
         # Older CLI versions don't work with Python 3.13.16 or newer because their Python extractor
         # imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
@@ -123,7 +123,7 @@ jobs:
         if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
         uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
-          python-version: '3.13.15'
+          python-version: "3.13.15"
 
       - name: Use Xcode 16
         # Only the older CodeQL CLI versions need Xcode 16, and these run on macOS 15.
@@ -133,7 +133,7 @@ jobs:
       - uses: ./../action/init
         id: init
         with:
-          db-location: '${{ runner.temp }}/customDbLocation'
+          db-location: "${{ runner.temp }}/customDbLocation"
           languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby' || '' }}
           tools: ${{ steps.prepare-test.outputs.tools-url }}
 
diff --git a/.github/workflows/__overlay-init-fallback.yml b/.github/workflows/__overlay-init-fallback.yml
index a2c320fb53..3cdcec3717 100644
--- a/.github/workflows/__overlay-init-fallback.yml
+++ b/.github/workflows/__overlay-init-fallback.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -53,8 +53,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: actions # Any language without overlay support will do
diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml
index 070d7e3910..3b703bea5e 100644
--- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml
+++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Config and input passed to the CLI'
+name: "PR Check - Packaging: Config and input passed to the CLI"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -60,7 +60,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Config and input passed to the CLI'
+    name: "Packaging: Config and input passed to the CLI"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging3.yml'
+          config-file: ".github/codeql/codeql-config-packaging3.yml"
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Check results
diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml
index 3465616dbf..6a346631ef 100644
--- a/.github/workflows/__packaging-config-inputs-js.yml
+++ b/.github/workflows/__packaging-config-inputs-js.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Config and input'
+name: "PR Check - Packaging: Config and input"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -60,7 +60,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Config and input'
+    name: "Packaging: Config and input"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging3.yml'
+          config-file: ".github/codeql/codeql-config-packaging3.yml"
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Check results
diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml
index 0e7b828c0a..75f426c346 100644
--- a/.github/workflows/__packaging-config-js.yml
+++ b/.github/workflows/__packaging-config-js.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Config file'
+name: "PR Check - Packaging: Config file"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -60,7 +60,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Config file'
+    name: "Packaging: Config file"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,18 +93,18 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging.yml'
+          config-file: ".github/codeql/codeql-config-packaging.yml"
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       - name: Build code
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Check results
diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml
index 80c792069d..be72e2556e 100644
--- a/.github/workflows/__packaging-inputs-js.yml
+++ b/.github/workflows/__packaging-inputs-js.yml
@@ -3,7 +3,7 @@
 #     pr-checks/sync.sh
 # to regenerate this file.
 
-name: 'PR Check - Packaging: Action input'
+name: "PR Check - Packaging: Action input"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -60,7 +60,7 @@ jobs:
             version: default
           - os: ubuntu-26.04
             version: nightly-latest
-    name: 'Packaging: Action input'
+    name: "Packaging: Action input"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -93,11 +93,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging2.yml'
+          config-file: ".github/codeql/codeql-config-packaging2.yml"
           languages: javascript
           packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -105,7 +105,7 @@ jobs:
         run: ./build.sh
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
 
       - name: Check results
         uses: ./../action/.github/actions/check-sarif
diff --git a/.github/workflows/__per-language-bundle-validation.yml b/.github/workflows/__per-language-bundle-validation.yml
index cb6b1a773d..3313ac010a 100644
--- a/.github/workflows/__per-language-bundle-validation.yml
+++ b/.github/workflows/__per-language-bundle-validation.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -95,8 +95,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Remove CodeQL from toolcache
         run: |
           cd ./../action
diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml
index 485a4904c8..1f8b1f1271 100644
--- a/.github/workflows/__remote-config.yml
+++ b/.github/workflows/__remote-config.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml
index 7a4e284d72..2d0ebd6fb0 100644
--- a/.github/workflows/__resolve-environment-action.yml
+++ b/.github/workflows/__resolve-environment-action.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: go,javascript-typescript
diff --git a/.github/workflows/__ruby.yml b/.github/workflows/__ruby.yml
index 833e49789e..8ce015624c 100644
--- a/.github/workflows/__ruby.yml
+++ b/.github/workflows/__ruby.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -61,8 +61,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: ruby
diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml
index 83cdbf6771..0e08f9919d 100644
--- a/.github/workflows/__rust.yml
+++ b/.github/workflows/__rust.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -59,8 +59,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           languages: rust
diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml
index 0cb63b85cc..b80d368192 100644
--- a/.github/workflows/__split-workflow.yml
+++ b/.github/workflows/__split-workflow.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -90,11 +90,11 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
-          config-file: '.github/codeql/codeql-config-packaging3.yml'
+          config-file: ".github/codeql/codeql-config-packaging3.yml"
           packs: +codeql-testing/codeql-pack1@1.0.0
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -103,7 +103,7 @@ jobs:
       - uses: ./../action/analyze
         with:
           skip-queries: true
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
 
       - name: Assert No Results
@@ -114,7 +114,7 @@ jobs:
           fi
       - uses: ./../action/analyze
         with:
-          output: '${{ runner.temp }}/results'
+          output: "${{ runner.temp }}/results"
           upload-database: false
       - name: Assert Results
         run: |
diff --git a/.github/workflows/__start-proxy.yml b/.github/workflows/__start-proxy.yml
index e6906cbc3c..a636a1bf59 100644
--- a/.github/workflows/__start-proxy.yml
+++ b/.github/workflows/__start-proxy.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Setup proxy for registries
         id: proxy
         uses: ./../action/start-proxy
@@ -101,5 +101,5 @@ jobs:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           config-file: codeql-action@main:tests/multi-language-repo/.github/codeql/custom-queries.yml
     env:
-      CODEQL_ACTION_PROXY_API_REQUESTS: 'true'
+      CODEQL_ACTION_PROXY_API_REQUESTS: "true"
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__submit-sarif-failure.yml b/.github/workflows/__submit-sarif-failure.yml
index b7edd62fc0..8eb219c9be 100644
--- a/.github/workflows/__submit-sarif-failure.yml
+++ b/.github/workflows/__submit-sarif-failure.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -55,8 +55,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./init
         with:
@@ -76,7 +76,7 @@ jobs:
         # `category` input. Without this step, that part of the init post-action would fail.
         if: false
         with:
-          category: '/test-codeql-version:${{ matrix.version }}'
+          category: "/test-codeql-version:${{ matrix.version }}"
     env:
       CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF: true
       CODEQL_ACTION_UPLOAD_FAILED_SARIF: true
diff --git a/.github/workflows/__swift-autobuild.yml b/.github/workflows/__swift-autobuild.yml
index 4ba28f3489..cc67bfdb63 100644
--- a/.github/workflows/__swift-autobuild.yml
+++ b/.github/workflows/__swift-autobuild.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -51,8 +51,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml
index c38f0daa12..1d1a8d9f17 100644
--- a/.github/workflows/__swift-custom-build.yml
+++ b/.github/workflows/__swift-custom-build.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -84,8 +84,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
@@ -107,5 +107,5 @@ jobs:
             exit 1
           fi
     env:
-      DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
+      DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml
index 6ef214e709..77896566e5 100644
--- a/.github/workflows/__unset-environment.yml
+++ b/.github/workflows/__unset-environment.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -82,8 +82,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         id: init
         with:
diff --git a/.github/workflows/__unsupported-macos.yml b/.github/workflows/__unsupported-macos.yml
index 5e388d1ec0..167473b480 100644
--- a/.github/workflows/__unsupported-macos.yml
+++ b/.github/workflows/__unsupported-macos.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs: {}
   workflow_call:
@@ -62,8 +62,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Check xcode_select_link
         run: |
           readlink /private/var/db/xcode_select_link
@@ -86,7 +86,7 @@ jobs:
         if: false
         uses: ./analyze
         with:
-          category: '/test-codeql-version:${{ matrix.version }}'
+          category: "/test-codeql-version:${{ matrix.version }}"
     env:
       CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
       CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml
index 079bc65971..f0f38c32e4 100644
--- a/.github/workflows/__upload-ref-sha-input.yml
+++ b/.github/workflows/__upload-ref-sha-input.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -80,8 +80,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -92,12 +92,12 @@ jobs:
       # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           upload: never
       - uses: ./../action/upload-sarif
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
     env:
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml
index c35fb3f597..a1f53bbbe6 100644
--- a/.github/workflows/__upload-sarif.yml
+++ b/.github/workflows/__upload-sarif.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -87,8 +87,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
@@ -99,8 +99,8 @@ jobs:
       # Generate some SARIF we can upload with the upload-sarif step
       - uses: ./../action/analyze
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           upload: never
           output: ${{ runner.temp }}/results
 
@@ -109,15 +109,15 @@ jobs:
         uses: ./../action/upload-sarif
         id: upload-sarif
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/
-      - name: 'Fail for missing output from `upload-sarif` step for `code-scanning`'
+      - name: "Fail for missing output from `upload-sarif` step for `code-scanning`"
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-scanning)
         run: exit 1
-      - name: 'Fail for missing output from `upload-sarif` step for `code-quality`'
+      - name: "Fail for missing output from `upload-sarif` step for `code-quality`"
         if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-sarif.outputs.sarif-ids).code-quality)
         run: exit 1
 
@@ -126,12 +126,12 @@ jobs:
         id: upload-single-sarif-code-scanning
         if: contains(matrix.analysis-kinds, 'code-scanning')
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results/javascript.sarif
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/
-      - name: 'Fail for missing output from `upload-single-sarif-code-scanning` step'
+      - name: "Fail for missing output from `upload-single-sarif-code-scanning` step"
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-sarif-code-scanning.outputs.sarif-ids).code-scanning)
         run: exit 1
       - name: Upload single SARIF file for Code Quality
@@ -139,12 +139,12 @@ jobs:
         id: upload-single-sarif-code-quality
         if: contains(matrix.analysis-kinds, 'code-quality')
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/
-      - name: 'Fail for missing output from `upload-single-sarif-code-quality` step'
+      - name: "Fail for missing output from `upload-single-sarif-code-quality` step"
         if: contains(matrix.analysis-kinds, 'code-quality') && !(fromJSON(steps.upload-single-sarif-code-quality.outputs.sarif-ids).code-quality)
         run: exit 1
 
@@ -156,12 +156,12 @@ jobs:
         id: upload-single-non-sarif
         if: contains(matrix.analysis-kinds, 'code-scanning')
         with:
-          ref: 'refs/heads/main'
-          sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+          ref: "refs/heads/main"
+          sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
           sarif_file: ${{ runner.temp }}/results/javascript.sarif.json
           category: |
             ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/
-      - name: 'Fail for missing output from `upload-single-non-sarif` step'
+      - name: "Fail for missing output from `upload-single-non-sarif` step"
         if: contains(matrix.analysis-kinds, 'code-scanning') && !(fromJSON(steps.upload-single-non-sarif.outputs.sarif-ids).code-scanning)
         run: exit 1
     env:
diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml
index d3c849c739..cef72ae57c 100644
--- a/.github/workflows/__with-checkout-path.yml
+++ b/.github/workflows/__with-checkout-path.yml
@@ -17,7 +17,7 @@ on:
     types:
       - checks_requested
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
     inputs:
       dotnet-version:
@@ -29,7 +29,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
   workflow_call:
     inputs:
       dotnet-version:
@@ -41,7 +41,7 @@ on:
         type: string
         description: The version of Go to install
         required: false
-        default: '>=1.21.0'
+        default: ">=1.21.0"
 defaults:
   run:
     shell: bash
@@ -81,8 +81,8 @@ jobs:
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
+          use-all-platform-bundle: "false"
+          setup-kotlin: "true"
       - name: Delete original checkout
         run: |
           # delete the original checkout so we don't accidentally use it.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 451238b668..efbb246fc9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -8,7 +8,7 @@ on:
     types: [checks_requested]
   schedule:
     # Weekly on Sunday.
-    - cron: '30 1 * * 0'
+    - cron: "30 1 * * 0"
   workflow_dispatch:
 
 defaults:
@@ -32,41 +32,41 @@ jobs:
       security-events: read
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Set up default CodeQL bundle
-      id: setup-default
-      uses: ./setup-codeql
-    - name: Set up linked CodeQL bundle
-      id: setup-linked
-      uses: ./setup-codeql
-      with:
-        tools: linked
-    - name: Compare default and linked CodeQL bundle versions
-      id: compare
-      env:
-        CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
-        CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
-      run: |
-        CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
-        CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
-        echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
-        echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up default CodeQL bundle
+        id: setup-default
+        uses: ./setup-codeql
+      - name: Set up linked CodeQL bundle
+        id: setup-linked
+        uses: ./setup-codeql
+        with:
+          tools: linked
+      - name: Compare default and linked CodeQL bundle versions
+        id: compare
+        env:
+          CODEQL_DEFAULT: ${{ steps.setup-default.outputs.codeql-path }}
+          CODEQL_LINKED: ${{ steps.setup-linked.outputs.codeql-path }}
+        run: |
+          CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
+          CODEQL_VERSION_LINKED="$("$CODEQL_LINKED" version --format terse)"
+          echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
+          echo "Linked CodeQL bundle version is $CODEQL_VERSION_LINKED"
 
-        # If we're running on a pull request, run with both bundles, even if `tools: linked` would
-        # be the same as `tools: null`. This allows us to make the job for each of the bundles a
-        # required status check.
-        #
-        # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
-        # the same as running with `tools: null`.
-        if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
-          VERSIONS_JSON='[null]'
-        else
-          VERSIONS_JSON='[null, "linked"]'
-        fi
+          # If we're running on a pull request, run with both bundles, even if `tools: linked` would
+          # be the same as `tools: null`. This allows us to make the job for each of the bundles a
+          # required status check.
+          #
+          # If we're running on push or schedule, then we can skip running with `tools: linked` when it would be
+          # the same as running with `tools: null`.
+          if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LINKED" ]]; then
+            VERSIONS_JSON='[null]'
+          else
+            VERSIONS_JSON='[null, "linked"]'
+          fi
 
-        # Output a JSON-encoded list with the distinct versions to test against.
-        echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
-        echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
+          # Output a JSON-encoded list with the distinct versions to test against.
+          echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
+          echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
 
   analyze-javascript:
     if: github.triggering_actor != 'dependabot[bot]'
@@ -74,7 +74,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
+        os:
+          - ubuntu-22.04
+          - ubuntu-24.04
+          - windows-2022
+          - windows-2025
+          - macos-14-xlarge
+          - macos-15-xlarge
         tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
     runs-on: ${{ matrix.os }}
 
@@ -83,26 +89,26 @@ jobs:
       security-events: write
 
     steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Initialize CodeQL
-      uses: ./init
-      id: init
-      with:
-        languages: javascript
-        config-file: ./.github/codeql/codeql-config-javascript.yml
-        tools: ${{ matrix.tools }}
-    # confirm steps.init.outputs.codeql-path points to the codeql binary
-    - name: Print CodeQL Version
-      run: >
-        "$CODEQL" version --format=json
-      env:
-        CODEQL: ${{steps.init.outputs.codeql-path}}
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
-      with:
-        category: "/language:javascript"
-        upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Initialize CodeQL
+        uses: ./init
+        id: init
+        with:
+          languages: javascript
+          config-file: ./.github/codeql/codeql-config-javascript.yml
+          tools: ${{ matrix.tools }}
+      # confirm steps.init.outputs.codeql-path points to the codeql binary
+      - name: Print CodeQL Version
+        run: >
+          "$CODEQL" version --format=json
+        env:
+          CODEQL: ${{steps.init.outputs.codeql-path}}
+      - name: Perform CodeQL Analysis
+        uses: ./analyze
+        with:
+          category: "/language:javascript"
+          upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && github.event_name != 'merge_group' && 'always' ) || 'never' }}
 
   analyze-other:
     if: github.triggering_actor != 'dependabot[bot]'
@@ -119,21 +125,21 @@ jobs:
       security-events: write
 
     steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Initialize CodeQL
-      uses: ./init
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: none
-        config: >
-          paths-ignore:
-            - lib
-            - tests
-          queries:
-            - uses: security-and-quality
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
-      with:
-        category: "/language:${{ matrix.language }}"
-        upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Initialize CodeQL
+        uses: ./init
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config: >
+            paths-ignore:
+              - lib
+              - tests
+            queries:
+              - uses: security-and-quality
+      - name: Perform CodeQL Analysis
+        uses: ./analyze
+        with:
+          category: "/language:${{ matrix.language }}"
+          upload: ${{ (github.event_name != 'merge_group' && 'always') || 'never' }}
diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml
index b1194460d3..f2d819bbc4 100644
--- a/.github/workflows/codescanning-config-cli.yml
+++ b/.github/workflows/codescanning-config-cli.yml
@@ -10,13 +10,13 @@ env:
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -41,187 +41,187 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-26.04
-          version: linked
-        - os: ubuntu-26.04
-          version: default
-        - os: ubuntu-26.04
-          version: nightly-latest
+          - os: ubuntu-26.04
+            version: linked
+          - os: ubuntu-26.04
+            version: default
+          - os: ubuntu-26.04
+            version: nightly-latest
 
     # Code-Scanning config not created because environment variable is not set
     name: Code Scanning Configuration tests
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-    - name: Set up Node.js
-      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-      with:
-        node-version: 24
-        cache: 'npm'
-
-    - name: Install dependencies
-      run: npm ci
-
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
-
-    - name: Empty file
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: "{}"
-        # Request multiple languages so later checks can reuse the combined bundle.
-        languages: javascript,python
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Packs from input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Packs from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries from input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-          }
-        languages: javascript
-        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from input with +
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-            "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+
+      - name: Empty file
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: "{}"
+          # Request multiple languages so later checks can reuse the combined bundle.
+          languages: javascript,python
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Packs from input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
             }
-          }
-        languages: javascript
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config overriden by input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
-            "packs": ["codeql/javascript-queries"]
-          }
-        languages: javascript
-        queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: codeql/javascript-queries
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Queries and packs from config merging with input
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
-          }
-        languages: javascript
-        queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
-        packs: + codeql/javascript-queries
-        config-file-test: .github/codeql/queries-and-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Multi-language packs from config
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "packs": {
-              "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
-              "ruby": ["codeql/ruby-queries"]
-            },
-            "queries": [
-              { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
-            ]
-          }
-        languages: javascript,ruby
-        config-file-test: .github/codeql/multi-language-packs-config.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - name: Other config properties
-      if: success() || failure()
-      uses: ./../action/.github/actions/check-codescanning-config
-      with:
-        expected-config-file-contents: |
-          {
-            "name": "Config using all properties",
-            "packs": ["codeql/javascript-queries" ],
-            "disable-default-queries": true,
-            "paths-ignore": ["xxx"],
-            "paths": ["yyy"]
-          }
-        languages: javascript
-        packs: + codeql/javascript-queries
-        config-file-test: .github/codeql/other-config-properties.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+          languages: javascript
+          packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Packs from input with +
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+            }
+          languages: javascript
+          packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries from input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
+            }
+          languages: javascript
+          queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries from input with +
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }]
+            }
+          languages: javascript
+          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries and packs from input with +
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
+              "packs": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+            }
+          languages: javascript
+          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          packs: + codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries and packs from config
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }],
+              "packs": {
+                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ]
+              }
+            }
+          languages: javascript
+          config-file-test: .github/codeql/queries-and-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries and packs from config overriden by input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "queries": [{ "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" }],
+              "packs": ["codeql/javascript-queries"]
+            }
+          languages: javascript
+          queries: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          packs: codeql/javascript-queries
+          config-file-test: .github/codeql/queries-and-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Queries and packs from config merging with input
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": {
+                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2", "codeql/javascript-queries" ]
+              },
+              "queries": [
+                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql" },
+                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+              ]
+            }
+          languages: javascript
+          queries: + ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
+          packs: + codeql/javascript-queries
+          config-file-test: .github/codeql/queries-and-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Multi-language packs from config
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "packs": {
+                "javascript": ["codeql-testing/codeql-pack1@1.0.0", "codeql-testing/codeql-pack2" ],
+                "ruby": ["codeql/ruby-queries"]
+              },
+              "queries": [
+                { "uses": "./codeql-qlpacks/complex-javascript-qlpack/foo2/show_ifs.ql" }
+              ]
+            }
+          languages: javascript,ruby
+          config-file-test: .github/codeql/multi-language-packs-config.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Other config properties
+        if: success() || failure()
+        uses: ./../action/.github/actions/check-codescanning-config
+        with:
+          expected-config-file-contents: |
+            {
+              "name": "Config using all properties",
+              "packs": ["codeql/javascript-queries" ],
+              "disable-default-queries": true,
+              "paths-ignore": ["xxx"],
+              "paths": ["yyy"]
+            }
+          languages: javascript
+          packs: + codeql/javascript-queries
+          config-file-test: .github/codeql/other-config-properties.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index cb6bf9e07a..54a616407c 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -64,7 +64,7 @@ jobs:
           npm ci
 
       - name: Verify compiled JS up to date
-        run: .github/workflows/script/check-js.sh
+        run: npx tsx pr-checks/check-unchanged.ts --language javascript
 
       - name: Run unit tests
         if: always()
@@ -122,6 +122,9 @@ jobs:
         id: install-deps
         run: npm ci
 
+      - name: Verify YAML is correctly formatted
+        run: npx tsx pr-checks/check-unchanged.ts --language yaml
+
       - name: Verify PR checks up to date
         if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
         run: .github/workflows/script/verify-pr-checks.sh
diff --git a/.github/workflows/publish-immutable-action.yml b/.github/workflows/publish-immutable-action.yml
index 5e5623bb07..83485875cc 100644
--- a/.github/workflows/publish-immutable-action.yml
+++ b/.github/workflows/publish-immutable-action.yml
@@ -1,10 +1,10 @@
-name: 'Publish Immutable Action Version'
+name: "Publish Immutable Action Version"
 
 on:
   push:
     tags:
       # Match version tags, but not the major version tags.
-      - 'v[0-9]+.**'
+      - "v[0-9]+.**"
 
 defaults:
   run:
diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml
index 303f54f1f2..9ce50b8ffc 100644
--- a/.github/workflows/python312-windows.yml
+++ b/.github/workflows/python312-windows.yml
@@ -8,7 +8,7 @@ on:
     types: [checks_requested]
   schedule:
     # Weekly on Monday.
-    - cron: '0 0 * * 1'
+    - cron: "0 0 * * 1"
   workflow_dispatch:
 
 concurrency:
@@ -32,22 +32,22 @@ jobs:
     runs-on: windows-2025
 
     steps:
-    - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
-      with:
-        python-version: 3.12
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: 3.12
 
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - name: Prepare test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: default
+      - name: Prepare test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: default
 
-    - name: Initialize CodeQL
-      uses: ./../action/init
-      with:
-        tools: linked
-        languages: python
+      - name: Initialize CodeQL
+        uses: ./../action/init
+        with:
+          tools: linked
+          languages: python
 
-    - name: Analyze
-      uses: ./../action/analyze
+      - name: Analyze
+        uses: ./../action/analyze
diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml
index 745e84b2e8..69ccd6c686 100644
--- a/.github/workflows/query-filters.yml
+++ b/.github/workflows/query-filters.yml
@@ -3,13 +3,13 @@ name: Query filters tests
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -29,47 +29,47 @@ jobs:
     permissions:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - name: Install Node.js
-      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-      with:
-        node-version: 24
-        cache: npm
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: npm
 
-    - name: Install dependencies
-      run: npm ci
+      - name: Install dependencies
+        run: npm ci
 
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: linked
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: linked
 
-    - name: Check SARIF for default queries with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip
-        queries-not-run: js/path-injection
-        config-file: ./.github/codeql/codeql-config-query-filters1.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check SARIF for default queries with Single include, Single exclude
+        uses: ./../action/.github/actions/query-filter-test
+        with:
+          sarif-file: ${{ runner.temp }}/results/javascript.sarif
+          queries-run: js/zipslip
+          queries-not-run: js/path-injection
+          config-file: ./.github/codeql/codeql-config-query-filters1.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Check SARIF for query packs with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip,javascript/example/empty-or-one-block
-        queries-not-run: js/path-injection
-        config-file: ./.github/codeql/codeql-config-query-filters2.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check SARIF for query packs with Single include, Single exclude
+        uses: ./../action/.github/actions/query-filter-test
+        with:
+          sarif-file: ${{ runner.temp }}/results/javascript.sarif
+          queries-run: js/zipslip,javascript/example/empty-or-one-block
+          queries-not-run: js/path-injection
+          config-file: ./.github/codeql/codeql-config-query-filters2.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
 
-    - name: Check SARIF for query packs and local queries with Single include, Single exclude
-      uses: ./../action/.github/actions/query-filter-test
-      with:
-        sarif-file:  ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
-        queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
-        config-file: ./.github/codeql/codeql-config-query-filters3.yml
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Check SARIF for query packs and local queries with Single include, Single exclude
+        uses: ./../action/.github/actions/query-filter-test
+        with:
+          sarif-file: ${{ runner.temp }}/results/javascript.sarif
+          queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
+          queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
+          config-file: ./.github/codeql/codeql-config-query-filters3.yml
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
diff --git a/.github/workflows/script/check-js.sh b/.github/workflows/script/check-js.sh
deleted file mode 100755
index 57638dcf25..0000000000
--- a/.github/workflows/script/check-js.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/bash
-set -eu
-
-# Sanity check that repo is clean to start with
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then this workflow needs attention...
-    >&2 echo "Failed: Repo should be clean before testing!"
-    exit 1
-fi
-# Wipe the lib directory in case there are extra unnecessary files in there
-rm -rf lib
-# Generate the JavaScript files
-npm run-script build
-# Check that repo is still clean
-if [ ! -z "$(git status --porcelain)" ]; then
-    # If we get a fail here then the PR needs attention
-    >&2 echo "Failed: JavaScript files are not up to date. Run 'rm -rf lib && npm run-script build' to update"
-    git status
-
-    echo "### Transpiled JS diff" >> $GITHUB_STEP_SUMMARY
-    echo "" >> $GITHUB_STEP_SUMMARY
-    echo '```diff' >> $GITHUB_STEP_SUMMARY
-    git diff --output="$RUNNER_TEMP/js.diff"
-    cat "$RUNNER_TEMP/js.diff" >> $GITHUB_STEP_SUMMARY
-    echo '```' >> $GITHUB_STEP_SUMMARY
-
-    # Reset bundled files to allow other checks to test for changes
-    git checkout lib
-
-    # Fail this check
-    exit 1
-fi
-echo "Success: JavaScript files are up to date"
diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml
index cf63b1caa5..9fae4b04a6 100644
--- a/.github/workflows/test-codeql-bundle-all.yml
+++ b/.github/workflows/test-codeql-bundle-all.yml
@@ -1,17 +1,17 @@
-name: 'PR Check - CodeQL Bundle All'
+name: "PR Check - CodeQL Bundle All"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -27,9 +27,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-26.04
-          version: nightly-latest
-    name: 'CodeQL Bundle All'
+          - os: ubuntu-26.04
+            version: nightly-latest
+    name: "CodeQL Bundle All"
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
@@ -37,26 +37,26 @@ jobs:
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
-    - name: Check out repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
-        use-all-platform-bundle: true
-    - name: Install .NET
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-      with:
-        dotnet-version: '9.x'
-    - id: init
-      uses: ./../action/init
-      with:
-        # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
-        languages: cpp,csharp,go,java,javascript,python,ruby
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - name: Build code
-      run: ./build.sh
-    - uses: ./../action/analyze
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: true
+      - name: Install .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: "9.x"
+      - id: init
+        uses: ./../action/init
+        with:
+          # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu
+          languages: cpp,csharp,go,java,javascript,python,ruby
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Build code
+        run: ./build.sh
+      - uses: ./../action/analyze
     env:
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml
index d7d90b749a..c2aae42eb4 100644
--- a/.github/workflows/update-bundle.yml
+++ b/.github/workflows/update-bundle.yml
@@ -30,7 +30,7 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
+          GITHUB_CONTEXT: "${{ toJson(github) }}"
         run: echo "$GITHUB_CONTEXT"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -44,7 +44,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install dependencies
         run: npm ci
diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index 6ceb30c42b..098b9c8af8 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -38,43 +38,43 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-    - uses: ./.github/actions/release-initialise
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # Need full history for calculation of diffs
+      - uses: ./.github/actions/release-initialise
 
-    # when the workflow has been manually triggered on main,
-    # we know that we definitely want the release branch to exist
-    - name: Ensure release branch exists
-      run: |
-        echo "MAJOR_VERSION ${MAJOR_VERSION}"
-        RELEASE_BRANCH=releases/${MAJOR_VERSION}
-        if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
-            echo "Branch $RELEASE_BRANCH already exists"
-            echo ""
-        else
-            echo "Creating $RELEASE_BRANCH branch"
-            git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
-            git push --set-upstream origin ${RELEASE_BRANCH}
-            git branch --show-current
-            echo ""
-        fi
-        echo "Returning to branch: ${REF_NAME}"
-        git checkout ${REF_NAME}
+      # when the workflow has been manually triggered on main,
+      # we know that we definitely want the release branch to exist
+      - name: Ensure release branch exists
+        run: |
+          echo "MAJOR_VERSION ${MAJOR_VERSION}"
+          RELEASE_BRANCH=releases/${MAJOR_VERSION}
+          if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
+              echo "Branch $RELEASE_BRANCH already exists"
+              echo ""
+          else
+              echo "Creating $RELEASE_BRANCH branch"
+              git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
+              git push --set-upstream origin ${RELEASE_BRANCH}
+              git branch --show-current
+              echo ""
+          fi
+          echo "Returning to branch: ${REF_NAME}"
+          git checkout ${REF_NAME}
 
-    - name: Update current release branch
-      if: github.event_name == 'workflow_dispatch'
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        echo SOURCE_BRANCH=${REF_NAME}
-        echo TARGET_BRANCH=releases/${MAJOR_VERSION}
-        npx tsx ./pr-checks/update-release-branch.ts \
-          --repository-nwo ${{ github.repository }} \
-          --source-branch '${{ env.REF_NAME }}' \
-          --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
-          --is-primary-release \
-          --conductor ${GITHUB_ACTOR}
+      - name: Update current release branch
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo SOURCE_BRANCH=${REF_NAME}
+          echo TARGET_BRANCH=releases/${MAJOR_VERSION}
+          npx tsx ./pr-checks/update-release-branch.ts \
+            --repository-nwo ${{ github.repository }} \
+            --source-branch '${{ env.REF_NAME }}' \
+            --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
+            --is-primary-release \
+            --conductor ${GITHUB_ACTOR}
 
   backport:
     name: "Create backport"
@@ -94,28 +94,28 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-    - name: Generate token
-      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-      id: app-token
-      with:
-        app-id: ${{ vars.AUTOMATION_APP_ID }}
-        private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
+      - name: Generate token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        id: app-token
+        with:
+          app-id: ${{ vars.AUTOMATION_APP_ID }}
+          private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
 
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        fetch-depth: 0  # Need full history for calculation of diffs
-        token: ${{ steps.app-token.outputs.token }}
-    - uses: ./.github/actions/release-initialise
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # Need full history for calculation of diffs
+          token: ${{ steps.app-token.outputs.token }}
+      - uses: ./.github/actions/release-initialise
 
-    - name: Update older release branch
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        echo SOURCE_BRANCH=${SOURCE_BRANCH}
-        echo TARGET_BRANCH=${TARGET_BRANCH}
-        npx tsx ./pr-checks/update-release-branch.ts \
-          --repository-nwo ${{ github.repository }} \
-          --source-branch ${SOURCE_BRANCH} \
-          --target-branch ${TARGET_BRANCH} \
-          --conductor ${GITHUB_ACTOR}
+      - name: Update older release branch
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo SOURCE_BRANCH=${SOURCE_BRANCH}
+          echo TARGET_BRANCH=${TARGET_BRANCH}
+          npx tsx ./pr-checks/update-release-branch.ts \
+            --repository-nwo ${{ github.repository }} \
+            --source-branch ${SOURCE_BRANCH} \
+            --target-branch ${TARGET_BRANCH} \
+            --conductor ${GITHUB_ACTOR}
diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml
index 6510f11e25..90e3e991a9 100644
--- a/.github/workflows/update-supported-enterprise-server-versions.yml
+++ b/.github/workflows/update-supported-enterprise-server-versions.yml
@@ -29,7 +29,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install dependencies
         run: npm ci
diff --git a/.vscode/settings.json b/.vscode/settings.json
index 6f31392754..3413d182e3 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -15,7 +15,7 @@
   "search.exclude": {
     "**/node_modules": true,
     "build": true,
-    "lib": true,
+    "lib": true
   },
   // Installing a new Node package often triggers VS Code's git limit warnings as there is typically
   // an intermediate stage where many files are modified. This setting suppresses these warnings.
@@ -26,4 +26,9 @@
   "[typescript]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
   },
+  "[yaml]": {
+    "editor.tabSize": 2,
+    "editor.defaultFormatter": "esbenp.prettier-vscode"
+  },
+  "prettier.prettierPath": "./node_modules/prettier"
 }
diff --git a/action.yml b/action.yml
index 87c4974ea9..b410533bec 100644
--- a/action.yml
+++ b/action.yml
@@ -1,10 +1,10 @@
-name: 'CodeQL: Stub'
+name: "CodeQL: Stub"
 description: "Stub: Don't use this action directly. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead."
-author: 'GitHub'
+author: "GitHub"
 runs:
-  using: 'composite'
+  using: "composite"
   steps:
-    - name: 'Stub'
+    - name: "Stub"
       run: |
         echo 'This is a stub. Read [the documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) instead.'
         exit 1
diff --git a/autobuild/action.yml b/autobuild/action.yml
index b87da541d6..3191149146 100644
--- a/autobuild/action.yml
+++ b/autobuild/action.yml
@@ -1,6 +1,6 @@
-name: 'CodeQL: Autobuild'
-description: 'Attempt to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead.'
-author: 'GitHub'
+name: "CodeQL: Autobuild"
+description: "Attempt to automatically build the code. Only used for analyzing languages that require a build. Use the `build-mode: autobuild` input in the `init` action instead."
+author: "GitHub"
 inputs:
   token:
     description: "GitHub token to use for authenticating with this instance of GitHub. The token needs the `security-events: write` permission."
@@ -16,4 +16,4 @@ inputs:
     required: false
 runs:
   using: node24
-  main: '../lib/autobuild-entry.js'
+  main: "../lib/autobuild-entry.js"
diff --git a/init/action.yml b/init/action.yml
index 8d26999f7a..b6721a8c7b 100644
--- a/init/action.yml
+++ b/init/action.yml
@@ -1,6 +1,6 @@
-name: 'CodeQL: Init'
-description: 'Set up CodeQL'
-author: 'GitHub'
+name: "CodeQL: Init"
+description: "Set up CodeQL"
+author: "GitHub"
 inputs:
   tools:
     description: >-
@@ -56,7 +56,7 @@ inputs:
       - `code-scanning`: The default, security-focused analysis.
       - `code-quality`: Analysis focused on code quality. This must be enabled in conjunction
                         with `code-scanning`.
-    default: 'code-scanning'
+    default: "code-scanning"
     required: true
   token:
     description: GitHub token to use for authenticating with this instance of GitHub. To download custom packs from multiple registries, use the registries input.
@@ -100,7 +100,7 @@ inputs:
     description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
     required: false
   quality-queries:
-    description: '[Internal] DEPRECATED. Comma-separated list of code quality queries to run.'
+    description: "[Internal] DEPRECATED. Comma-separated list of code quality queries to run."
     required: false
   packs:
     description: >-
@@ -140,7 +140,7 @@ inputs:
       This will result in more output being produced which may be useful when debugging certain issues.
       Debugging mode is enabled automatically when step debug logging is turned on.
     required: false
-    default: 'false'
+    default: "false"
   debug-artifact-name:
     description: >-
       The name of the artifact to store debugging information in.
@@ -181,5 +181,5 @@ outputs:
     description: The version of the CodeQL binary used for analysis
 runs:
   using: node24
-  main: '../lib/init-entry.js'
-  post: '../lib/init-post-entry.js'
+  main: "../lib/init-entry.js"
+  post: "../lib/init-post-entry.js"
diff --git a/lib/entry-points.js b/lib/entry-points.js
index b2bb9c1835..4d52598610 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -185926,8 +185926,7 @@ async function setupDiffInformedQueryRun(logger2, checkoutPath) {
   );
 }
 function diffRangeExtensionPackContents(ranges, checkoutPath) {
-  const header = `
-extensions:
+  const header = `extensions:
   - addsTo:
       pack: codeql/util
       extensible: restrictAlertsTo
@@ -185936,7 +185935,7 @@ extensions:
 `;
   let data = ranges.map((range2) => {
     const filename = path16.join(checkoutPath, range2.path).replaceAll(path16.sep, "/");
-    return `      - [${dump(filename, { forceQuotes: true, quoteStyle: "single" }).trim()}, ${range2.startLine}, ${range2.endLine}]
+    return `      - [${dump(filename, { forceQuotes: true, quoteStyle: "double" }).trim()}, ${range2.startLine}, ${range2.endLine}]
 `;
   }).join("");
   if (!data) {
diff --git a/package-lock.json b/package-lock.json
index c1a68345a2..b4196655b8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -62,6 +62,7 @@
         "glob": "^13.0.6",
         "globals": "^17.13.0",
         "nock": "^14.0.17",
+        "prettier": "^3.9.10",
         "sinon": "^22.1.0",
         "typescript": "^6.0.3",
         "typescript-eslint": "^8.72.0"
@@ -8670,9 +8671,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.4.1.tgz",
-      "integrity": "sha512-G+YdqtITVZmOJje6QkXQWzl3fSfMxFwm1tjTyo9exhkmWSqC4Yhd1+lug++IlR2mvRVAxEDDWYkQdeSztajqgg==",
+      "version": "3.9.10",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.10.tgz",
+      "integrity": "sha512-skGHTH1Yb9QvaTC4hWnRTzEYtCpApF0UMBPz+t/0ZPzP8ihefo/btKd+QA7pUE0fEwA1SbS/NmhyEcstdXOIdA==",
       "dev": true,
       "license": "MIT",
       "bin": {
diff --git a/package.json b/package.json
index cfd11dd5ff..5e6f8e7d3c 100644
--- a/package.json
+++ b/package.json
@@ -6,6 +6,7 @@
   "scripts": {
     "_build_comment": "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
     "build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+    "format-yaml": "prettier --write --parser yaml '**/*.{yml,yaml}'",
     "lint": "eslint --report-unused-disable-directives --max-warnings=0 .",
     "lint-ci": "SARIF_ESLINT_IGNORE_SUPPRESSED=true eslint --report-unused-disable-directives --max-warnings=0 . --format @microsoft/eslint-formatter-sarif --output-file=eslint.sarif",
     "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --fix",
@@ -70,6 +71,7 @@
     "glob": "^13.0.6",
     "globals": "^17.13.0",
     "nock": "^14.0.17",
+    "prettier": "^3.9.10",
     "sinon": "^22.1.0",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.72.0"
diff --git a/pr-checks/check-unchanged.ts b/pr-checks/check-unchanged.ts
new file mode 100755
index 0000000000..809ddbb67d
--- /dev/null
+++ b/pr-checks/check-unchanged.ts
@@ -0,0 +1,152 @@
+#!/usr/bin/env npx tsx
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parseArgs } from "node:util";
+
+import * as core from "@actions/core";
+
+import { runCommand, runGit } from "./command";
+import { LIB_ROOT, PR_CHECKS_DIR, REPO_ROOT } from "./config";
+import { getErrorMessage } from "./util";
+
+/**
+ * Checks whether the repo is clean by running `git status --porcelain`.
+ * If the repository is not clean, the changes are printed to stdout.
+ *
+ * @returns `true` if the repo is clean or `false` otherwise.
+ */
+function isRepoClean(): boolean {
+  const stdout = runGit(["status", "--porcelain"]);
+
+  if (stdout === "") {
+    return true;
+  }
+
+  console.log(stdout);
+  return false;
+}
+
+/**
+ * Checks whether the repository is clean to begin with, then runs {@link body}, and finally
+ * checks if the repository is still clean.
+ *
+ * @param body The function to run.
+ * @returns `true` if the repo is clean or `false` otherwise.
+ */
+function checkUnchanged(body: () => void): boolean {
+  // Sanity check that repo is clean to start with
+  if (isRepoClean()) {
+    console.info("Repository is clean.");
+  } else {
+    // If we get a fail here then this workflow needs attention...
+    console.error("The repository contains uncomitted changes!");
+    return false;
+  }
+
+  body();
+
+  // Check that repo is still clean
+  const result = isRepoClean();
+  if (result) {
+    console.info("Repository is still clean.");
+  } else {
+    console.info("Repository is now dirty.");
+  }
+  return result;
+}
+
+/**
+ * Produces a full diff for the repository and adds it to the workflow job summary
+ * under the {@link summaryHeader} header.
+ */
+async function addDiffToSummary(summaryHeader: string) {
+  const diffFile = path.join(
+    process.env["RUNNER_TEMP"] ?? PR_CHECKS_DIR,
+    "summary.diff",
+  );
+
+  try {
+    runCommand("git", ["status"]);
+    runCommand("git", ["diff", `--output=${diffFile}`], {
+      execOptions: { cwd: REPO_ROOT },
+    });
+
+    core.summary.addHeading(summaryHeader, 3);
+    core.summary.addCodeBlock(fs.readFileSync(diffFile, "utf-8"), "diff");
+    await core.summary.write();
+
+    try {
+      fs.rmSync(diffFile);
+    } catch (err) {
+      console.warn(
+        `Failed to remove temporary diff file from '${diffFile}': ${getErrorMessage(err)}`,
+      );
+    }
+  } catch (err) {
+    console.error(
+      `Failed to add full diff to summary for '${summaryHeader}': ${getErrorMessage(err)}`,
+    );
+  }
+}
+
+/**
+ * Rebuilds the JavaScript by cleaning up and running `npm run build`.
+ */
+function rebuildJavaScript() {
+  // Wipe the lib directory in case there are extra unnecessary files in there
+  console.info(`Removing ${LIB_ROOT}...`);
+  fs.rmSync(LIB_ROOT, { recursive: true, force: true });
+
+  // Generate the JavaScript files
+  runCommand("npm", ["run", "build"], { execOptions: { shell: true } });
+}
+
+/**
+ * Formats YAML files with `npm run format-yaml`.
+ */
+function formatYAML() {
+  runCommand("npm", ["run", "format-yaml"], { execOptions: { shell: true } });
+}
+
+async function main() {
+  const { values: options } = parseArgs({
+    options: { language: { type: "string", default: "javascript" } },
+  });
+  console.info(`Checking that ${options.language} files are unchanged.`);
+
+  if (options.language === "javascript") {
+    if (!checkUnchanged(rebuildJavaScript)) {
+      // If we get a fail here then the PR needs attention
+      console.error("Failed: JavaScript files are not up to date.");
+      console.error("Run 'rm -rf lib && npm run build' to update.");
+
+      await addDiffToSummary("Transpiled JS diff");
+
+      // Reset bundled files to allow other checks to test for changes
+      runCommand("git", ["checkout", "lib"]);
+
+      return 1;
+    }
+
+    console.info("Success: JavaScript files are up to date");
+  } else if (options.language === "yaml") {
+    if (!checkUnchanged(formatYAML)) {
+      // If we get a fail here then the PR needs attention
+      console.error("Failed: YAML files are not correctly formatted.");
+      console.error("Run 'npm run format-yaml' to format them.");
+
+      await addDiffToSummary("YAML formatting changes");
+
+      return 1;
+    }
+
+    console.info("Success: YAML files are correctly formatted");
+  } else {
+    console.error(`Unknown language: ${options.language}`);
+  }
+
+  return 0;
+}
+
+process.exit(await main());
diff --git a/pr-checks/checks/analyze-ref-input.yml b/pr-checks/checks/analyze-ref-input.yml
index 683d40df9f..16231cefe2 100644
--- a/pr-checks/checks/analyze-ref-input.yml
+++ b/pr-checks/checks/analyze-ref-input.yml
@@ -14,5 +14,5 @@ steps:
     run: ./build.sh
   - uses: ./../action/analyze
     with:
-      ref: 'refs/heads/main'
-      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      ref: "refs/heads/main"
+      sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
diff --git a/pr-checks/checks/init-with-registries.yml b/pr-checks/checks/init-with-registries.yml
index 69e2188de2..ffa5f4d128 100644
--- a/pr-checks/checks/init-with-registries.yml
+++ b/pr-checks/checks/init-with-registries.yml
@@ -23,9 +23,9 @@ steps:
       config-file: ./.github/codeql/codeql-config-registries.yml
       languages: javascript
       registries: |
-          - url: "https://ghcr.io/v2/"
-            packages: "*/*"
-            token: "${{ secrets.GITHUB_TOKEN }}"
+        - url: "https://ghcr.io/v2/"
+          packages: "*/*"
+          token: "${{ secrets.GITHUB_TOKEN }}"
 
   - name: Verify packages installed
     run: |
diff --git a/pr-checks/checks/overlay-init-fallback.yml b/pr-checks/checks/overlay-init-fallback.yml
index 26d8c85672..48b9f19b18 100644
--- a/pr-checks/checks/overlay-init-fallback.yml
+++ b/pr-checks/checks/overlay-init-fallback.yml
@@ -6,7 +6,7 @@ versions:
 steps:
   - uses: ./../action/init
     with:
-      languages: actions   # Any language without overlay support will do
+      languages: actions # Any language without overlay support will do
       tools: ${{ steps.prepare-test.outputs.tools-url }}
     env:
       CODEQL_OVERLAY_DATABASE_MODE: overlay-base
diff --git a/pr-checks/checks/upload-ref-sha-input.yml b/pr-checks/checks/upload-ref-sha-input.yml
index 9700827151..7a737c7def 100644
--- a/pr-checks/checks/upload-ref-sha-input.yml
+++ b/pr-checks/checks/upload-ref-sha-input.yml
@@ -15,10 +15,10 @@ steps:
   # Generate some SARIF we can upload with the upload-sarif step
   - uses: ./../action/analyze
     with:
-      ref: 'refs/heads/main'
-      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      ref: "refs/heads/main"
+      sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
       upload: never
   - uses: ./../action/upload-sarif
     with:
-      ref: 'refs/heads/main'
-      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      ref: "refs/heads/main"
+      sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
diff --git a/pr-checks/checks/upload-sarif.yml b/pr-checks/checks/upload-sarif.yml
index 8056a5179c..205bdf0a29 100644
--- a/pr-checks/checks/upload-sarif.yml
+++ b/pr-checks/checks/upload-sarif.yml
@@ -19,8 +19,8 @@ steps:
   # Generate some SARIF we can upload with the upload-sarif step
   - uses: ./../action/analyze
     with:
-      ref: 'refs/heads/main'
-      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      ref: "refs/heads/main"
+      sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
       upload: never
       output: ${{ runner.temp }}/results
 
@@ -29,8 +29,8 @@ steps:
     uses: ./../action/upload-sarif
     id: upload-sarif
     with:
-      ref: 'refs/heads/main'
-      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      ref: "refs/heads/main"
+      sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
       sarif_file: ${{ runner.temp }}/results
       category: |
         ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:all-files/
@@ -46,8 +46,8 @@ steps:
     id: upload-single-sarif-code-scanning
     if: contains(matrix.analysis-kinds, 'code-scanning')
     with:
-      ref: 'refs/heads/main'
-      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      ref: "refs/heads/main"
+      sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
       sarif_file: ${{ runner.temp }}/results/javascript.sarif
       category: |
         ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-scanning/
@@ -59,8 +59,8 @@ steps:
     id: upload-single-sarif-code-quality
     if: contains(matrix.analysis-kinds, 'code-quality')
     with:
-      ref: 'refs/heads/main'
-      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      ref: "refs/heads/main"
+      sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
       sarif_file: ${{ runner.temp }}/results/javascript.quality.sarif
       category: |
         ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:single-code-quality/
@@ -76,8 +76,8 @@ steps:
     id: upload-single-non-sarif
     if: contains(matrix.analysis-kinds, 'code-scanning')
     with:
-      ref: 'refs/heads/main'
-      sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
+      ref: "refs/heads/main"
+      sha: "5e235361806c361d4d3f8859e3c897658025a9a2"
       sarif_file: ${{ runner.temp }}/results/javascript.sarif.json
       category: |
         ${{ github.workflow }}:upload-sarif/analysis-kinds:${{ matrix.analysis-kinds }}/os:${{ matrix.os }}/version:${{ matrix.version }}/test:non-sarif/
diff --git a/pr-checks/command.ts b/pr-checks/command.ts
new file mode 100644
index 0000000000..459265c0d6
--- /dev/null
+++ b/pr-checks/command.ts
@@ -0,0 +1,81 @@
+import { execFileSync, ExecFileSyncOptions } from "node:child_process";
+
+import { DryRunOption, REPO_ROOT } from "./config";
+
+/** Options for {@link runCommand}. */
+export interface RunCommandOptions extends DryRunOption {
+  /** Options for `execFileSync`. */
+  execOptions?: ExecFileSyncOptions;
+}
+
+/**
+ * Runs a command, streaming output to the console by default.
+ *
+ * @param command The name of the command to run.
+ * @param args The arguments for the command.
+ * @throws When the process exits with a non-zero exit code.
+ * @param options How to run the command.
+ */
+export function runCommand(
+  command: string,
+  args: string[],
+  options?: RunCommandOptions,
+) {
+  if (!options?.dryRun) {
+    console.log(`Running \`${command} ${args.join(" ")}\`.`);
+    return execFileSync(command, args, {
+      stdio: "inherit",
+      cwd: REPO_ROOT,
+      ...options?.execOptions,
+    });
+  } else {
+    console.info(
+      `[DRY RUN] Would have executed '${command} ${args.join(" ")}'`,
+    );
+    return "";
+  }
+}
+
+/** Options for {@link runGit}. */
+export interface RunGitOptions extends DryRunOption {
+  /** When true, non-zero exit codes will not throw. */
+  allowNonZeroExitCode?: boolean;
+}
+
+/**
+ * Runs `git` with the given `args` and returns the stdout.
+ *
+ * @param args - Arguments to pass to `git`.
+ * @param options - Optional settings.
+ * @throws If `git` does not exit successfully, unless
+ *         `options.allowNonZeroExitCode` is `true`.
+ * @returns The trimmed stdout output.
+ */
+export function runGit(args: string[], options?: RunGitOptions): string {
+  const execOptions: ExecFileSyncOptions = {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+  };
+
+  try {
+    const result = runCommand("git", args, {
+      dryRun: options?.dryRun,
+      execOptions,
+    }) as string;
+    return result.trimEnd();
+  } catch (error: unknown) {
+    if (options?.allowNonZeroExitCode) {
+      // execFileSync throws an object with `stdout` when the process exits
+      // with a non-zero code.
+      const execError = error as { stdout?: Buffer | string };
+      if (typeof execError.stdout === "string") {
+        return execError.stdout.trimEnd();
+      }
+      if (Buffer.isBuffer(execError.stdout)) {
+        return execError.stdout.toString("utf8").trimEnd();
+      }
+      return "";
+    }
+    throw error;
+  }
+}
diff --git a/pr-checks/config.ts b/pr-checks/config.ts
index 876654a1cc..a7228bb566 100644
--- a/pr-checks/config.ts
+++ b/pr-checks/config.ts
@@ -30,7 +30,13 @@ export const CHANGENOTES_DIR = path.join(REPO_ROOT, "unreleased-change-notes");
 export const BUNDLE_METADATA_FILE = path.join(REPO_ROOT, "meta.json");
 
 /** The `src` directory. */
-const SOURCE_ROOT = path.join(REPO_ROOT, "src");
+export const SOURCE_ROOT = path.join(REPO_ROOT, "src");
+
+/** The `lib` directory. */
+export const LIB_ROOT = path.join(REPO_ROOT, "lib");
+
+/** The path to `defaults.json`. */
+export const DEFAULTS_FILE = path.join(SOURCE_ROOT, "defaults.json");
 
 /** The path to the built-in languages file. */
 export const BUILTIN_LANGUAGES_FILE = path.join(
diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 0953816c21..ec8d5a57c3 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -370,7 +370,7 @@ function writeYaml(filePath: string, workflow: any): void {
   });
   const yamlStr = yaml.stringify(workflowDoc, {
     aliasDuplicateObjects: false,
-    singleQuote: true,
+    singleQuote: false,
     lineWidth: 0,
   });
   fs.writeFileSync(filePath, stripTrailingWhitespace(header + yamlStr), "utf8");
@@ -595,16 +595,6 @@ function generateJob(
   // Extract the sequence of steps from the YAML document to persist as much formatting as possible.
   const specSteps = specDocument.get("steps") as yaml.YAMLSeq;
 
-  // A handful of workflow specifications use double quotes for values, while we generally use single quotes.
-  // This replaces double quotes with single quotes for consistency.
-  yaml.visit(specSteps, {
-    Scalar(_key, node) {
-      if (node.type === "QUOTE_DOUBLE") {
-        node.type = "QUOTE_SINGLE";
-      }
-    },
-  });
-
   // Add the generated steps in front of the ones from the specification.
   specSteps.items.unshift(...steps);
 
@@ -802,7 +792,7 @@ function main(): void {
     }
 
     const cron = new yaml.Scalar("0 5 * * *");
-    cron.type = yaml.Scalar.QUOTE_SINGLE;
+    cron.type = yaml.Scalar.QUOTE_DOUBLE;
 
     const workflow = {
       name: `PR Check - ${checkSpecification.name}`,
diff --git a/pr-checks/update-release-branch.ts b/pr-checks/update-release-branch.ts
index 9d46fd3ecd..ca76603a32 100755
--- a/pr-checks/update-release-branch.ts
+++ b/pr-checks/update-release-branch.ts
@@ -18,18 +18,14 @@
  *     [--dry-run]
  */
 
-import { execFileSync, type ExecFileSyncOptions } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { parseArgs } from "node:util";
 
 import { type ApiClient, getApiClient } from "./api-client";
 import * as changelog from "./changelog";
 import { transferChangenotesToChangelog } from "./changenotes";
-import {
-  CHANGELOG_FILE,
-  CHANGENOTES_DIR,
-  DryRunOption,
-  REPO_ROOT,
-} from "./config";
+import { runCommand, runGit } from "./command";
+import { CHANGELOG_FILE, CHANGENOTES_DIR } from "./config";
 import {
   getCurrentVersion,
   replaceVersionInPackageJson,
@@ -71,84 +67,6 @@ export function getGitHubToken(): string {
   throw new Error("Missing GitHub token. Set GITHUB_TOKEN or GH_TOKEN.");
 }
 
-/** Options for {@link runCommand}. */
-export interface RunCommandOptions extends DryRunOption {
-  /** Options for `execFileSync`. */
-  execOptions?: ExecFileSyncOptions;
-}
-
-/**
- * Runs a command, streaming output to the console by default.
- *
- * @param command The name of the command to run.
- * @param args The arguments for the command.
- * @throws When the process exits with a non-zero exit code.
- * @param options How to run the command.
- */
-export function runCommand(
-  command: string,
-  args: string[],
-  options?: RunCommandOptions,
-) {
-  if (!options?.dryRun) {
-    console.log(`Running \`${command} ${args.join(" ")}\`.`);
-    return execFileSync(command, args, {
-      stdio: "inherit",
-      cwd: REPO_ROOT,
-      ...options?.execOptions,
-    });
-  } else {
-    console.info(
-      `[DRY RUN] Would have executed '${command} ${args.join(" ")}'`,
-    );
-    return "";
-  }
-}
-
-/** Options for {@link runGit}. */
-export interface RunGitOptions extends DryRunOption {
-  /** When true, non-zero exit codes will not throw. */
-  allowNonZeroExitCode?: boolean;
-}
-
-/**
- * Runs `git` with the given `args` and returns the stdout.
- *
- * @param args - Arguments to pass to `git`.
- * @param options - Optional settings.
- * @throws If `git` does not exit successfully, unless
- *         `options.allowNonZeroExitCode` is `true`.
- * @returns The trimmed stdout output.
- */
-export function runGit(args: string[], options?: RunGitOptions): string {
-  const execOptions: ExecFileSyncOptions = {
-    encoding: "utf8",
-    stdio: ["pipe", "pipe", "pipe"],
-  };
-
-  try {
-    const result = runCommand("git", args, {
-      dryRun: options?.dryRun,
-      execOptions,
-    }) as string;
-    return result.trimEnd();
-  } catch (error: unknown) {
-    if (options?.allowNonZeroExitCode) {
-      // execFileSync throws an object with `stdout` when the process exits
-      // with a non-zero code.
-      const execError = error as { stdout?: Buffer | string };
-      if (typeof execError.stdout === "string") {
-        return execError.stdout.trimEnd();
-      }
-      if (Buffer.isBuffer(execError.stdout)) {
-        return execError.stdout.toString("utf8").trimEnd();
-      }
-      return "";
-    }
-    throw error;
-  }
-}
-
 /** Returns true if the given branch exists on the origin remote. */
 export function branchExistsOnRemote(branchName: string): boolean {
   const result = runGit(["ls-remote", "--heads", ORIGIN, branchName]);
diff --git a/resolve-environment/action.yml b/resolve-environment/action.yml
index b93efb20d5..5e03ecac4b 100644
--- a/resolve-environment/action.yml
+++ b/resolve-environment/action.yml
@@ -1,6 +1,6 @@
-name: 'CodeQL: Resolve Build Environment'
-description: '[Experimental] Attempt to infer a build environment suitable for automatic builds'
-author: 'GitHub'
+name: "CodeQL: Resolve Build Environment"
+description: "[Experimental] Attempt to infer a build environment suitable for automatic builds"
+author: "GitHub"
 inputs:
   token:
     description: "GitHub token to use for authenticating with this instance of GitHub. The token must be the built-in GitHub Actions token, and the workflow must have the `security-events: write` permission. Most of the time it is advisable to avoid specifying this input so that the workflow falls back to using the default value."
@@ -22,4 +22,4 @@ outputs:
     description: The inferred build environment configuration.
 runs:
   using: node24
-  main: '../lib/resolve-environment-entry.js'
+  main: "../lib/resolve-environment-entry.js"
diff --git a/setup-codeql/action.yml b/setup-codeql/action.yml
index 14083b4f95..8d9c5a0883 100644
--- a/setup-codeql/action.yml
+++ b/setup-codeql/action.yml
@@ -1,6 +1,6 @@
-name: 'CodeQL: Setup'
-description: 'Installs the CodeQL CLI'
-author: 'GitHub'
+name: "CodeQL: Setup"
+description: "Installs the CodeQL CLI"
+author: "GitHub"
 inputs:
   tools:
     description: >-
@@ -33,7 +33,7 @@ inputs:
       suited to those analysis kinds.
 
       Available options are the same as for the `analysis-kinds` input on the `init` Action.
-    default: 'code-scanning'
+    default: "code-scanning"
     required: true
   token:
     description: GitHub token to use for authenticating with this instance of GitHub.
@@ -52,4 +52,4 @@ outputs:
     description: The version of the CodeQL binary that was installed.
 runs:
   using: node24
-  main: '../lib/setup-codeql-entry.js'
+  main: "../lib/setup-codeql-entry.js"
diff --git a/src/analyze-action.ts b/src/analyze-action.ts
index 23ce54d30f..ff7deb489b 100644
--- a/src/analyze-action.ts
+++ b/src/analyze-action.ts
@@ -59,13 +59,10 @@ import { postProcessAndUploadSarif } from "./upload-sarif";
 import * as util from "./util";
 
 interface AnalysisStatusReport
-  extends uploadLib.UploadStatusReport,
-    QueriesStatusReport {}
+  extends uploadLib.UploadStatusReport, QueriesStatusReport {}
 
 interface FinishStatusReport
-  extends StatusReportBase,
-    DatabaseCreationTimings,
-    AnalysisStatusReport {
+  extends StatusReportBase, DatabaseCreationTimings, AnalysisStatusReport {
   dependency_caching_upload_results?: DependencyCacheUploadStatusReport;
   database_upload_results: DatabaseUploadResult[];
 }
@@ -222,8 +219,8 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
   const logger = action.logger;
 
   let uploadResults:
-    | Partial<Record<analyses.AnalysisKind, UploadResult>>
-    | undefined = undefined;
+    Partial<Record<analyses.AnalysisKind, UploadResult>> | undefined =
+    undefined;
   let runStats: QueriesStatusReport | undefined = undefined;
   let config: Config | undefined = undefined;
   let trapCacheUploadTime: number | undefined = undefined;
diff --git a/src/analyze.ts b/src/analyze.ts
index 2da347c134..692d2ef1db 100644
--- a/src/analyze.ts
+++ b/src/analyze.ts
@@ -54,7 +54,9 @@ type RunQueriesDurationStatusReport = {
    * The "builtin" designation is now outdated with the move to CLI config parsing: this is the time
    * taken to run _all_ the queries.
    */
-  [L in BuiltInLanguageKey as `analyze_builtin_queries_${L}_duration_ms`]?: number;
+  [
+    L in BuiltInLanguageKey as `analyze_builtin_queries_${L}_duration_ms`
+  ]?: number;
 };
 
 type InterpretResultsDurationStatusReport = {
@@ -63,8 +65,7 @@ type InterpretResultsDurationStatusReport = {
 };
 
 export interface QueriesStatusReport
-  extends RunQueriesDurationStatusReport,
-    InterpretResultsDurationStatusReport {
+  extends RunQueriesDurationStatusReport, InterpretResultsDurationStatusReport {
   /**
    * Whether the analysis is diff-informed (in the sense that the action generates a diff-range data
    * extension for the analysis, regardless of whether the data extension is actually used by queries).
@@ -319,8 +320,7 @@ export function diffRangeExtensionPackContents(
   ranges: DiffThunkRange[],
   checkoutPath: string,
 ): string {
-  const header = `
-extensions:
+  const header = `extensions:
   - addsTo:
       pack: codeql/util
       extensible: restrictAlertsTo
@@ -341,7 +341,7 @@ extensions:
       // characters are escaped, and that the path is always rendered as a
       // quoted string on a single line.
       return (
-        `      - [${yaml.dump(filename, { forceQuotes: true, quoteStyle: "single" }).trim()}, ` +
+        `      - [${yaml.dump(filename, { forceQuotes: true, quoteStyle: "double" }).trim()}, ` +
         `${range.startLine}, ${range.endLine}]\n`
       );
     })
diff --git a/src/debug-artifacts.ts b/src/debug-artifacts.ts
index 56497f14e8..23a5566547 100644
--- a/src/debug-artifacts.ts
+++ b/src/debug-artifacts.ts
@@ -276,9 +276,7 @@ export function getArtifactSuffix(matrix: string | undefined): string {
 
 // Enumerates different, possible outcomes for artifact uploads.
 export type UploadArtifactsResult =
-  | "no-artifacts-to-upload"
-  | "upload-successful"
-  | "upload-failed";
+  "no-artifacts-to-upload" | "upload-successful" | "upload-failed";
 
 /**
  * Uploads the specified files as a single workflow artifact.
diff --git a/src/environment.ts b/src/environment.ts
index 7776238e5d..c6c07f3e62 100644
--- a/src/environment.ts
+++ b/src/environment.ts
@@ -240,10 +240,7 @@ export enum SystemEnvVar {
 
 /** A type representing all known environment variables. */
 export type KnownEnvVar =
-  | EnvVar
-  | ActionsEnvVars
-  | RegistryProxyVars
-  | SystemEnvVar;
+  EnvVar | ActionsEnvVars | RegistryProxyVars | SystemEnvVar;
 
 /**
  * Gets an environment variable, but throws an error if it is not set.
diff --git a/src/init-action-post.ts b/src/init-action-post.ts
index 071137f547..5ae78637f5 100644
--- a/src/init-action-post.ts
+++ b/src/init-action-post.ts
@@ -44,7 +44,8 @@ import {
 import { checkDiskUsage, checkGitHubVersionInRange, wrapError } from "./util";
 
 interface InitPostStatusReport
-  extends StatusReportBase,
+  extends
+    StatusReportBase,
     initActionPostHelper.UploadFailedSarifResult,
     initActionPostHelper.JobStatusReport,
     initActionPostHelper.DependencyCachingUsageReport {}
@@ -56,8 +57,7 @@ async function run(action: ActionState<["Base", "Logger", "Env"]>) {
 
   let config: Config | AbortedInitConfig | undefined;
   let uploadFailedSarifResult:
-    | initActionPostHelper.UploadFailedSarifResult
-    | undefined;
+    initActionPostHelper.UploadFailedSarifResult | undefined;
   let dependencyCachingUsage: DependencyCachingUsageReport | undefined;
 
   try {
diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts
index 6cfd07b3b5..b67146a797 100644
--- a/src/setup-codeql.test.ts
+++ b/src/setup-codeql.test.ts
@@ -1869,8 +1869,7 @@ async function runDownloadCodeQL(
   return {
     codeqlFolder,
     cleanupDiagnostic: diagnostic?.attributes as
-      | toolsDownload.ToolcacheCleanupResult
-      | undefined,
+      toolsDownload.ToolcacheCleanupResult | undefined,
   };
 }
 
diff --git a/src/start-proxy/types.ts b/src/start-proxy/types.ts
index 17803e9126..68bde2b4bb 100644
--- a/src/start-proxy/types.ts
+++ b/src/start-proxy/types.ts
@@ -175,11 +175,7 @@ export const oidcSchemas = [
 
 /** Represents all supported OIDC configurations. */
 export type OIDC =
-  | AzureConfig
-  | AWSConfig
-  | JFrogConfig
-  | CloudsmithConfig
-  | GCPConfig;
+  AzureConfig | AWSConfig | JFrogConfig | CloudsmithConfig | GCPConfig;
 
 /** All authentication-related fields. */
 export type AuthConfig = UsernamePassword | Token | OIDC;
diff --git a/src/testdata/pr-diff-range.yml b/src/testdata/pr-diff-range.yml
index 073b83198a..24f02fbe3f 100644
--- a/src/testdata/pr-diff-range.yml
+++ b/src/testdata/pr-diff-range.yml
@@ -1,8 +1,7 @@
-
 extensions:
   - addsTo:
       pack: codeql/util
       extensible: restrictAlertsTo
       checkPresence: false
     data:
-      - ['/checkout/path/main.js', 10, 20]
+      - ["/checkout/path/main.js", 10, 20]
diff --git a/src/testing-utils.ts b/src/testing-utils.ts
index 2b8e634e9d..d3b495363a 100644
--- a/src/testing-utils.ts
+++ b/src/testing-utils.ts
@@ -488,10 +488,10 @@ export interface AssertableTarget<R> {
 }
 
 class CallableEnvBuilder<
-    Args extends readonly any[],
-    R,
-    Fs extends ReadonlyArray<AllState[number]>,
-  >
+  Args extends readonly any[],
+  R,
+  Fs extends ReadonlyArray<AllState[number]>,
+>
   extends BaseEnvBuilder<Args, R, Fs>
   implements AssertableTarget<R>
 {
diff --git a/src/upload-sarif-action.ts b/src/upload-sarif-action.ts
index 447314fb10..2ac5cd48e5 100644
--- a/src/upload-sarif-action.ts
+++ b/src/upload-sarif-action.ts
@@ -30,8 +30,7 @@ import {
 } from "./util";
 
 interface UploadSarifStatusReport
-  extends StatusReportBase,
-    upload_lib.UploadStatusReport {}
+  extends StatusReportBase, upload_lib.UploadStatusReport {}
 
 async function sendSuccessStatusReport(
   startedAt: Date,
diff --git a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml
index 91a8dce370..fbd19b7293 100644
--- a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml
+++ b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml
@@ -1,12 +1,12 @@
 name: "Check SARIF for default queries with Single include, Single exclude"
 
 query-filters:
-# This should run js/path-injection and js/zipslip
-- include:
-    tags contain:
+  # This should run js/path-injection and js/zipslip
+  - include:
+      tags contain:
         - external/cwe/cwe-022
 
-# Removes js/path-injection
-- exclude:
-    id:
+  # Removes js/path-injection
+  - exclude:
+      id:
         - js/path-injection
diff --git a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml
index c0d6869624..0bd794eb65 100644
--- a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml
+++ b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml
@@ -8,17 +8,17 @@ packs:
     - codeql-testing/codeql-pack1@1.0.0
 
 query-filters:
-# This should run js/path-injection and js/zipslip
-- include:
-    tags contain:
+  # This should run js/path-injection and js/zipslip
+  - include:
+      tags contain:
         - external/cwe/cwe-022
 
-# Removes js/path-injection
-- exclude:
-    id:
+  # Removes js/path-injection
+  - exclude:
+      id:
         - js/path-injection
 
-# Query from extra pack
-- include:
-    id:
+  # Query from extra pack
+  - include:
+      id:
         - javascript/example/empty-or-one-block
diff --git a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml
index 619442d0fd..26171f0bb6 100644
--- a/tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml
+++ b/tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml
@@ -3,37 +3,36 @@ name: "Check SARIF for query packs and local queries with Single include, Single
 disable-default-queries: true
 
 queries:
-# Local query
+  # Local query
   - name: Run an extra local query
     uses: ./codeql-qlpacks/javascript-qlpack/show_ifs.ql
 
-# These queries are ignored
+  # These queries are ignored
   - name: Ignored queries
     uses: ./codeql-qlpacks/complex-python-qlpack/rootAndBar.qls
 
-
 packs:
   javascript:
     - codeql/javascript-queries
     - codeql-testing/codeql-pack1@1.0.0
 
 query-filters:
-# This should run js/path-injection and js/zipslip
-- include:
-    tags contain:
-      - external/cwe/cwe-022
-
-# Removes js/path-injection
-- exclude:
-    id:
-      - js/path-injection
-
-# Query from extra pack
-- include:
-    id:
-      - javascript/example/empty-or-one-block
-
-# Local query
-- include:
-    id:
-      - inrepo-javascript-querypack/show-ifs
+  # This should run js/path-injection and js/zipslip
+  - include:
+      tags contain:
+        - external/cwe/cwe-022
+
+  # Removes js/path-injection
+  - exclude:
+      id:
+        - js/path-injection
+
+  # Query from extra pack
+  - include:
+      id:
+        - javascript/example/empty-or-one-block
+
+  # Local query
+  - include:
+      id:
+        - inrepo-javascript-querypack/show-ifs
diff --git a/tests/multi-language-repo/.github/codeql/custom-queries.yml b/tests/multi-language-repo/.github/codeql/custom-queries.yml
index fc80426f70..0e9ff0ff4e 100644
--- a/tests/multi-language-repo/.github/codeql/custom-queries.yml
+++ b/tests/multi-language-repo/.github/codeql/custom-queries.yml
@@ -3,22 +3,22 @@ name: Use custom queries
 disable-default-queries: true
 
 queries:
-# Query suites
+  # Query suites
   - name: Select a query suite
     uses: ./codeql-qlpacks/complex-python-qlpack/rootAndBar.qls
-# QL pack subset
+  # QL pack subset
   - name: Select a ql file
     uses: ./codeql-qlpacks/complex-javascript-qlpack/show_ifs.ql
   - name: Select a subfolder
     uses: ./codeql-qlpacks/complex-javascript-qlpack/foo
   - name: Select a folder with two subfolders
     uses: ./codeql-qlpacks/complex-javascript-qlpack/foo2
-# Inrepo QL pack
+  # Inrepo QL pack
   - name: Select an inrepo ql pack
     uses: ./codeql-qlpacks/csharp-qlpack
   - name: Java queries
     uses: ./codeql-qlpacks/java-qlpack
-# External QL packs
+  # External QL packs
   - name: Go queries
     uses: codeql-testing/go-querypack@master
   - name: Cpp queries
diff --git a/tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml
index 95acb04f05..2fc3910e27 100644
--- a/tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml
+++ b/tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml
@@ -1,3 +1,3 @@
 name: complex-javascript-querypack
 version: 0.0.1
-libraryPathDependencies: codeql-javascript
\ No newline at end of file
+libraryPathDependencies: codeql-javascript
diff --git a/tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml
index 349294dcfc..129bb60782 100644
--- a/tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml
+++ b/tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml
@@ -1,3 +1,3 @@
 name: inrepo-python-querypack
 version: 0.0.1
-libraryPathDependencies: codeql-python
\ No newline at end of file
+libraryPathDependencies: codeql-python
diff --git a/tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml
index 7c2ea26cde..5890a85433 100644
--- a/tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml
+++ b/tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml
@@ -1,3 +1,3 @@
 name: inrepo-cpp-querypack
 version: 0.0.1
-libraryPathDependencies: codeql-cpp
\ No newline at end of file
+libraryPathDependencies: codeql-cpp
diff --git a/tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml
index 9a54e7e92f..b917d2412b 100644
--- a/tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml
+++ b/tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml
@@ -1,3 +1,3 @@
 name: inrepo-csharp-querypack
 version: 0.0.1
-libraryPathDependencies: codeql-csharp
\ No newline at end of file
+libraryPathDependencies: codeql-csharp
diff --git a/tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml
index 59ccb68818..2bfd0c9a8f 100644
--- a/tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml
+++ b/tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml
@@ -1,3 +1,3 @@
 name: inrepo-go-querypack
 version: 0.0.1
-libraryPathDependencies: codeql-go
\ No newline at end of file
+libraryPathDependencies: codeql-go
diff --git a/tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml
index 06e8cae7d3..86533bde39 100644
--- a/tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml
+++ b/tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml
@@ -1,3 +1,3 @@
 name: inrepo-java-querypack
 version: 0.0.1
-libraryPathDependencies: codeql-java
\ No newline at end of file
+libraryPathDependencies: codeql-java
diff --git a/tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml
index f6d5a7b6db..0715661b48 100644
--- a/tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml
+++ b/tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml
@@ -1,3 +1,3 @@
 name: inrepo-javascript-querypack
 version: 0.0.1
-libraryPathDependencies: codeql-javascript
\ No newline at end of file
+libraryPathDependencies: codeql-javascript
diff --git a/tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml b/tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml
index 349294dcfc..129bb60782 100644
--- a/tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml
+++ b/tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml
@@ -1,3 +1,3 @@
 name: inrepo-python-querypack
 version: 0.0.1
-libraryPathDependencies: codeql-python
\ No newline at end of file
+libraryPathDependencies: codeql-python
diff --git a/tsconfig.json b/tsconfig.json
index 66545447c5..57136385fe 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -37,5 +37,5 @@
       "@octokit/core/dist-types/types": ["./node_modules/@octokit/core/dist-types/types.d.ts"]
     },
   },
-  "exclude": ["node_modules", "pr-checks"]
+  "exclude": ["node_modules", "pr-checks", "prettier.config.mts"]
 }
diff --git a/upload-sarif/action.yml b/upload-sarif/action.yml
index dae34ec528..75c5858e2f 100644
--- a/upload-sarif/action.yml
+++ b/upload-sarif/action.yml
@@ -1,6 +1,6 @@
-name: 'Code Scanning : Upload SARIF'
-description: 'Upload the analysis results'
-author: 'GitHub'
+name: "Code Scanning : Upload SARIF"
+description: "Upload the analysis results"
+author: "GitHub"
 inputs:
   sarif_file:
     description: |
@@ -8,7 +8,7 @@ inputs:
       See https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github#uploading-a-code-scanning-analysis-with-github-actions
       for information on the maximum number of results and maximum file size supported by code scanning.
     required: false
-    default: '../results'
+    default: "../results"
   checkout_path:
     description: "The path at which the analyzed repository was checked out. Used to relativize any absolute paths in the uploaded SARIF file."
     required: false
@@ -42,5 +42,5 @@ outputs:
       { "code-scanning": "some-id", "code-quality": "some-other-id" }
 runs:
   using: node24
-  main: '../lib/upload-sarif-entry.js'
-  post: '../lib/upload-sarif-post-entry.js'
+  main: "../lib/upload-sarif-entry.js"
+  post: "../lib/upload-sarif-post-entry.js"